computer networking ethereal/wireshark packet capture example
DESCRIPTION
Computer Networking Ethereal/Wireshark Packet Capture Example. Dr Sandra I. Woolley. Ethereal/Wireshark Example. - PowerPoint PPT PresentationTRANSCRIPT
Computer NetworkingEthereal/Wireshark Packet Capture Example
Dr Sandra I. Woolley
2
Ethereal/Wireshark Example Ethereal was a protocol analyzer that is now called Wireshark. It
is used for opening passing network packets and exploring their contents. It can be used to observe all passing packets for any users on the shared network connection. It is sometimes called a “packet sniffer”.
The following slides are taken from the example in Chapter Two of the course textbook. Note edition 2 of the book recommends use of Ethereal (we will use its replacement, Wireshark.)
The example summarises what happens when a user clicks on the nytimes url. As well as providing a simple visual example of the processes and protocols involved in the delivery of web page information, the example serves as a good introduction to the protocol analyzer.
3
Network Analyzer Example
Our user clicks on http://www.nytimes.com/ The network analyzer captures all frames observed by its NIC
(network interface controller). The sequence of frames and their contents can be examined in
detail down to individual bytes.
Internet
Encapsulation Reminder
TCP Header contains source & destination
port numbers
IP Header contains source and destination
IP addresses; transport protocol type
Ethernet Header contains source & destination MAC addresses; network protocol type
HTTP Request
TCP header HTTP Request
IP header
TCP header HTTP Request
Ethernet header
IP header
TCP header HTTP Request FCS
5
Ethereal/Wireshark WindowsTop Pane
shows frame/packet
sequence
Middle Pane shows
encapsulation for a given frame
Bottom Pane shows hex & text
6
Top Pane: Frame Sequence
DNS Query
TCP Connection
Setup HTTP Request & Response
7
Middle Pane: Encapsulation
Ethernet Frame
Ethernet Destination and
Source Addresses
Protocol Type
8
Middle pane: Encapsulation
IP Packet
IP Source and Destination Addresses
Protocol Type
And a lot of other stuff!
9
Middle Pane: Encapsulation
TCP Segment
Source and Destination Port
Numbers
HTTP Request
GET
Thank You